[NeMo-DDoS-List] FW: [Geant NeMo] Analysis for Alert #216448 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

[Hank Nussbacher]

________________________________________
From: nemo-ddos at host.geant.org <nemo-ddos at host.geant.org>
Sent: Saturday, October 11, 2025 7:14:33 PM (UTC+02:00) Jerusalem
To: soc at geant.org
Subject: [Geant NeMo] Analysis for Alert #216448 WARN: IUCC (AS378) - [Customer] [Email_Analysis] [IUCC]

Please find the analysis details for the Alert ID: 216448

Top-10 Src IPs by Packets:
   Packets   Est. Rate   % of Total                 Src IP
---------------------------------------------------------
  23720100       79067        13.7%          52.222.136.65
  21992700       73309        12.7%         52.222.136.124
  21082500       70275        12.1%         52.222.136.125
  18768000       62560        10.8%          52.222.136.15
   9095400       30318         5.2%   2001:bf8:900:d:2::71
   3742500       12475         2.2%            132.70.19.4
   3172800       10576         1.8%           132.69.32.30
   2951400        9838         1.7%          192.114.3.241
   2747400        9158         1.6%        185.216.140.186
   2554500        8515         1.5%         132.68.147.107

Top-10 Dst IPs by Packets:
   Packets   Est. Rate   % of Total                      Dst IP
--------------------------------------------------------------
  85565700      285219        49.3%                132.70.60.14
   6581100       21937         3.8%   2001:760:4205:128::130:70
   5047800       16826         2.9%               13.107.138.10
   4355400       14518         2.5%              142.251.209.42
   3968400       13228         2.3%               128.139.200.4
   3742500       12475         2.2%               20.209.177.33
   3612900       12043         2.1%              132.67.245.179
   3498000       11660         2.0%             128.139.225.245
   2514300        8381         1.4%    2001:1470:ff8a:6d:d14::1
   2397000        7990         1.4%              192.114.23.221

Top-10 Possible Targets by Bytes:
          Src IP   Src Port         Dst IP   Dst Port   Sampled Count
-------------------------------------------------------------------
                        443   132.70.60.14               126455846100
                              132.70.60.14               126455846100
   52.222.136.65        443                               35054943300
   52.222.136.65                                          35054943300
  52.222.136.124        443                               32492493300
  52.222.136.124                                          32492493300
  52.222.136.125        443                               31163743500
  52.222.136.125                                          31163743500
   52.222.136.15        443                               27741957900
   52.222.136.15                                          27741957900

Metric Info:
1M Packets/s

Alert Type:
time_window

Alert Description:
High packet rate.

Start Time: 2025-10-11 16:14:22
End Time: ongoing

First Event Seen: 2025-10-11 16:12:00
Last Event Seen: 2025-10-11 16:13:00

Further Details:
https://secondary.nemo.geant.org/alerts/details/216448/